BRAIN
An encrypted personal knowledge base that runs entirely on your own machine, with no server and no account.
- evaluation suites, all passing
- 20
- runtime dependencies in the whole app
- 2
- false rejection on the identity ladder
- 0%
The problem
A personal knowledge store is only worth having if it is both private and useful, and those usually trade against each other. Keeping notes, relationships and credentials on someone else's server makes them searchable but readable. Keeping them local usually means losing semantic search, cross-referencing, and any ability to prove something about their contents to a third party. BRAIN was an attempt to refuse the trade.
What I built
A React and TypeScript application over IndexedDB where every record is encrypted with XChaCha20-Poly1305 under a data key, itself wrapped by an argon2id-derived key. Each ciphertext is bound to its own row and field, so a blob moved elsewhere in the database fails to open rather than silently decrypting into the wrong place. Changing the passphrase re-wraps the data key instead of re-encrypting the corpus, so it is instant at any size.
Intelligence is layered so nothing depends on a model being available. Lexical retrieval is the floor. A 25 MB embedding model, fetched once and cached, adds semantic ranking and automatic cross-linking. An optional on-device language model is allowed only to rewrite template output, and a gate rejects fact-dumps, instruction parroting, repetition loops and truncation — returning nothing, so the deterministic template stands.
Packaged as an Electron desktop application with the model tree shipped alongside it, plus a zero-dependency WebGL visualisation of the corpus that receives only ids, lobes and timestamps — never titles or contents.
The hard part
Deciding what a signature is allowed to mean
The headline feature signs a challenge with a P-256 key that anyone can verify offline. Typing rhythm, face and voice all feed a presence assessment, but none of them can ever be key material — they are fuzzy, and a fuzzy value cannot produce a stable secret. So they gate visibility only, moving a session from stranger to uncertain to familiar to verified. Face or voice alone can reach familiar but never verified, because a photograph or a cloned voice cannot answer a recall question.
That forced an unusually narrow claim. The signature proves that this vault's key signed this challenge now, while the vault judged its owner present — and the presence half is the software's own attestation, not something the verifier can check. Writing the weaker true statement instead of the stronger marketable one is the actual engineering decision. The companion verifier is a single self-contained HTML file whose own content security policy forbids every network call, and a test imports that file as raw text and asserts its byte formats still match the application's, because two implementations of one format will otherwise drift apart.
Outcome
- 20 evaluation suites covering retrieval, identity, cryptographic binding, liveness, durability and export safety — several written to reproduce real shipped bugs before fixing them.
- Retrieval scores hit@1 and hit@3 of 100% on the easy ladder; the near-impostor identity ladder returns 0% false rejection and 5% false acceptance against a mimic 20ms off the real typing rhythm.
- A real plaintext-export leak was found by its own evaluation suite and closed by making the export firewall an allowlist rather than a denylist.
- A 398 MB Windows installer builds and runs with no server, no account and no network dependency.
Want something like this built? I take on a small number of projects at a time.